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Art Unit: 2131 

1 DETAILED ACTION 

2 This action is in response to the communication dated 1/23/2006. 

3 Response to Arguments 

4 Applicants' arguments with respect to claims 1-88, 1 13-147, 172-206, and 23 1-243, were 

5 not found persuasive. Applicants' argue primarily that the two characteristics relied upon by the 

6 examiner in both Le Pennec and Stewart are not "two different corresponding characteristics". 

7 With regards to Le Pennec, Le Pennec disclosed the comparison of "two characteristics", 

8 including a current file signature, and an original file signature that had been calculated 

9 previously (See Le Pennec Paragraphs 0124 and 0192). Clearly these are two characteristics, but 

10 contrary to the applicants' argument, these are also "different" and "corresponding" 

1 1 characteristics as well. It is easily seen that they are different as one signature, the file signature 

12 calculated by the VCF (virus-free Certificate Firewall), was calculated on the fly, during the 

13 comparison step (See Le Pennec Paragraph 0192) and the other signature, the signature 

14 comprised within the VC (virus-free Certificate) for the file, was calculated prior to the 

1 5 comparison step by the VCA (virus-free Certificate Authority) (See Le Pennec Paragraph 0124). 

16 Not only are they separate and distinct, as just shown, but they are also compared, which implies 

1 7 that they are not the same. If they were the same signature, there would be no need to compare 

1 8 the two as it would be inherent that they were the same. Therefore, it is seen that the two 

19 signatures are different. Further, the two signatures are both signatures of the same file, and 

20 therefore they are corresponding. As such, the two signatures, contrary to the applicants 

21 assertion, are in fact "two different corresponding characteristics" and as such the examiner does 

22 not find the argument persuasive. 
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1 With regards to Stewart, Stewart clearly disclosed analyzing the extension type (See 

2 Stewart Col. 3 Lines 45-65) with respect to the file content (See Stewart Col. 3 Line 65 - Col. 4 

3 Line 3). Therefore, Stewart did in fact disclose "two different corresponding characteristics" and 

4 as such, the examiner does not find the argument persuasive. 

5 Further, please note the new ground(s) of rejection necessitated by the amendment to the 

6 claims. 

7 All objections and rejections not presented below have been withdrawn. 

8 Claims 1-88, 1 13-147, 172-206, and 231-243 have been examined. 

9 Specification 

10 Applicant is reminded of the proper language and format for an abstract of the disclosure. 

11 

1 2 The abstract should be in narrative form and generally limited to a single paragraph on 

1 3 a separate sheet within the range of 50 to 150 words. It is important that the abstract not exceed 

14 150 words in length since the spade provided for the abstract on the computer tape used by the 

1 5 printer is limited. The form and legal phraseology often used in patent claims, such as 11 means 1 ' 

1 6 and "said, " should be avoided. The abstract should describe the disclosure sufficiently to assist 

1 7 readers in deciding whether there is a need for consulting the full patent text for details. 
18 

1 9 The language should be clear and concise and should not repeat information given in the 

20 title. It should avoid using phrases which can be implied, such as, 'The disclosure concerns, " 

2 1 "The disclosure defined by this invention, " "The disclosure describes, " etc. 
22 

23 The abstract of the disclosure is objected to because: 

24 The abstract of the disclosure fails to sufficiently describe the disclosed invention. In 

25 particular the abstract is silent with respect to the "different corresponding characteristics", the- 

26 gateway implementing the disclosed invention, or the types of characteristics being compared. 

27 As such, the abstract does not provide an ample description of the invention as disclosed in the 

28 specification and therefore would not properly assist a reader of the abstract in deciding whether 

29 to consult the full patent text. Appropriate correction is required. 
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1 

2 Claim Rejections - 35 USC §102 

3 The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 

4 basis for the rejections under this section made in this Office action: 

5 A person shall be entitled to a patent unless - 

6 (b) the invention was patented or described in a printed publication in this or a foreign 

7 country or in public use or on sale in this country, more than one year prior to the date of 

8 application for patent in the United States. 
9 

10 (e) the invention was described in (J) an application for patent, published under section 

1 1 1 22(b), by another filed in the United States before the invention by the applicant for patent or 

12 (2) a patent granted on an application for patent by another filed in the United States before the 

1 3 invention by the applicant for patent, except that an international application filed under the 

14 treaty defined in section 351(a) shall have the effects for purposes of this subsection of an 

15 application filed in the United States only if the international application designated the United 

1 6 States and was published under Article 21(2) of such treaty in the English language. 
17. 

18 Claims 1-14, 17-36, 39-44, 67-80, 83-88, 126-139, and 142-147 are rejected under 35 

19 ILS.C. 102(b) as being anticipated by Curtis ("Top 10 Tips for Avoiding Viruses". 

20 Regarding claim 1, Curtis disclosed a method of detecting malicious content comprising: 

21 examining at least two different corresponding characteristics of a digital object (See Curtis 

22 Section 8 Type, Icon, Extension); analyzing said at least two characteristics to determine 

23 whether there exists a mismatch therebetween (See Curtis Section 8); and upon determination of 

24 the existence of a mismatch, classifying said digital object as a digital object possibly containing 

25 malicious content (See Curtis First Paragraph and Section 8). 

26 Regarding claim 23, Curtis disclosed a method of detecting malicious content 

27 comprising: obtaining information relating to at least two different corresponding characteristics 

28 of a digital object (See Curtis Section 8); analyzing said information to categorize said digital 



s 
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1 object into at least two categories (See Curtis Section 8); comparing said at least two categories 

2 to decide whether there exists a mismatch therebetween (See Curtis Section 8); upon 

3 determination of the existence of a mismatch, classifying said digital object as a digital object 

4 possibly containing. malicious content (See Curtis First Paragraph and Section 8). 

5 Regarding claim 67, Curtis disclosed a system for detecting malicious content 

6 comprising: a digital. object examiner (Implementer of Curtis), examining at least two different 

7 corresponding characteristics of a digital object (See Curtis Section 8); a characteristics 

8 mismatch detector (Implementer of Curtis), analyzing said at least two characteristics to 

9 determine whether there exists a mismatch therebetween (See Curtis Section 8); and a digital 

10 object classifier (Implementer of Curtis), operative upon determination of the existence of a 

1 1 mismatch, classifying said digital object as a digital object possibly containing malicious content 

12 (See Curtis First Paragraph and Section 8). 

13 Regarding claim 126, Curtis disclosed a system for detecting malicious content 

14 comprising: a digital object information obtainer, obtaining information related to at least two 

15 different corresponding characteristics of a digital object (See Curtis Section 8); a characteristic 

16 based categorizer, categorizing said information into at least two categories (See Curtis Section 

17 8); a categories mismatch detector, analyzing said at least two categories to determine whether 

18 there exists a mismatch therebetween (See Curtis Section 8); and a digital object classifier, 

19 operative upon determination of the existence of a mismatch, classifying said digital object as a 

20 digital object possibly containing malicious content (See Curtis First Paragraph and Section 8). 

21 Regarding claims 2-3, 24-25, 68-69, 127-128, Curtis disclosed that malicious content 

22 comprises malicious code and masqueraded content (See Curtis First Paragraph and Section 8). 
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1 Regarding claims 4-6, 26-28, 70-72, 129-131, Curtis disclose that one of the 

2 characteristics is selected from header information, file content, file name extension, and file 

3 icon (See Curtis Section 8). 

4 Regarding claims 7-12, 29-34, 73-78, 132-137, Curtis disclosed that the digital object is 

5 one of a file, an e-mail attachment, a web page, and a storage medium (See Curtis Section 8). 

6 Regarding claims 13-14, 35-36, 79-80, 138-139, Curtis disclosed that the digital object 

7 was a file and e-mail attachment (See Curtis Section 8). 

8 Regarding claims 17-22, 39-44, 83-88, 142-147, =Curtis disclosed that the characteristics 

9 comprised header information (subject); file content (extension); file name extension; and file 

10 icon (See Curtis Section 8). 

11 
12 

13 Claims 1-14, 17-22, 67-80, and 83-88 are rejected under 35 U.S.C. 102(e) as being 

14 anticipated by Le Pennec et al. (US Patent Application Publication 2001/0020272) 

15 hereinafter referred to as Le Pennec, 

16 Regarding claim 1, Le Pennec disclosed a method of detecting malicious content 

17 comprising: examining at least two characteristics of a digital object (See Le Pennec Paragraph 

18 0192); analyzing said at least two different corresponding characteristics to determine whether 

19 there exists a mismatch therebetween (See Le Pennec Paragraph 0192); and upon determination 

20 of the existence of a mismatch, classifying said digital object as a digital object possibly 

21 containing malicious content (See Le Pennec Paragraph 0198). 

22 Regarding claim 67, Le Pennec disclosed a system for detecting malicious content 

23 comprising; a digital object examiner, examining at least two different corresponding 
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1 characteristics of a digital object (See Le Pennec Paragraph 0192); a characteristics mismatch 

2 detector, analyzing said at least two characteristics to determine whether there exists a 

3 mismatch therebetween (See Pennec Paragraph 0192); and a digital object classifier, operative 

4 upon determination of the existence of a mismatch, classifying said digital. object as a digital 

5 object possibly containing malicious content (See Le Pennec Paragraph 0198). 

6 Regarding claims 2-3, and 68-69, Le Pennec disclosed that malicious content comprises 

7 malicious code, and masqueraded content (See Le.Pennec Paragraphs 0009-0017). 

8 Regarding claims 4-6, 17-22, 70-72, and 83-88, Le Pennec disclosed that at least one of 

9 said at least two characteristics is selected from a set consisting of: header information; file 

10 content; file name extension; and file icon (See Le Pennec Paragraph 0192 wherein the 

1 1 signature of the file was computed which includes all of the listed characteristics of the file). 

12 Regarding claims 7-14, and 73-80, Le Pennec disclosed said digital object is selected 

13 from a set consisting of: a file; an e-mail attachment; a web page; and a storage medium (See 

14 Le Pennec Paragraph 0023). 

15 Claims 23-36, 39-40, 44, 126-139, 142-143, 147, and 172-184 are rejected under 35 

16 U.S.C. 102(e) as being anticipated by Stewart et al. (US Patent Number 6,901,519) 

17 hereinafter referred to as Stewart. 

18 Regarding claims 23 and 126, Stewart disclosed a method of detecting malicious content 

19 comprising: obtaining information relating to at least two different corresponding characteristics 

20 of a digital object (See Stewart Col. 3 Line 46 - Col. 4 Line 3); analyzing said information to 

21 categorize said digital object into at least two categories (See Stewart Col, 3 Line 46 - Col. 4 

22 Line 3); comparing said at least two categories to decide whether there exists a mismatch 
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1 therebetween (See Stewart Col. 3 Line 46 - Col. 4 Line 3); upon determination of the existence 

2 of a mismatch, classifying said digital object as a digital object possibly containing malicious 

3 content (See Stewart Col. 3 Line 46 - Col. 4 Line 3). 

4 Regarding claims 24-25, and 127-128, Stewart disclosed that malicious content 

5 comprises malicious code, and masqueraded content (See Stewart Col. 1 Lines 21-39). 

6 Regarding claims 26-28, 39-40, 44, 129-131, 142-143, and 147, Stewart disclosed that at 

7 least one of said at least two characteristics is selected from a set consisting of: header 

8 information; file content; file name extension; and file icon (See Stewart Col. 3 Line 46 - Col. 

9 4 Line 3 wherein the extension is header information). 

10 Regarding claims 29-36, and 132-139, Stewart disclosed that said digital object is 

1 1 selected from a set consisting of: a file; an e-mail attachment; a web page; and a storage 

12 medium (See Stewart Col. 3 Lines 56-58). 

13 Regarding claims 172-184, Stewart disclosed that said digital object information obtainer. 

14 comprises a digital object information obtainer gateway subsystem; said characteristic based 

1 5 categorizer comprises a characteristic based categorizer gateway subsystem; said categories 

16 mismatch detector comprising a mismatch detector gateway subsystem; and said digital object 

17 classifier comprising a mismatch detector gateway subsystem (See Stewart Fig. 1 Element 102 

18 and Col. 3 Lines 28-45). 

1 9 Claim Rejections - 35 USC § 1 03 

20 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

21 obviousness rejections set forth in this Office action: 

22 A patent may not be obtained though the invention is not identically disclosed or 

23 described as set forth in section 102 of this title, if the differences between the subject matter 
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1 sought to be patented and the prior art are such that the subject matter as a whole would have 

2 been obvious at the time the invention was made to a person having ordinary skill in the art to 

3 which said subject matter pertains. Patentability shall not be negatived by the manner in which 

4 the invention was made. 
5 

6 Claims 15-16, 37-38, 45-66, 81-82, 140-141, and 185-206 are rejected under 35 

7 U.S.C. 103(a) as being unpatentable over Curtis, 

8 Regarding claims 15-16, 37-38, 45, 59-60, 81-82, 140-141, 185, and 199-200, Curtis 

9 disclosed examining at least two different corresponding characteristics of a digital object; 
10 analyzing said at least two characteristics to determine whether there exists a mismatch 

1.1 therebetween; and upon determination of the existence of a mismatch, classifying said digital 

12 object as a digital object possibly containing malicious content (See the rejection of claim 1 

13 above), but failed to disclose that the characteristics may be selected by the creator of the digital 

14 object independently of selection of another characteristic and farther failed to disclose that the 

1 5 object could be a web page or storage medium. 

16 It was well known in the art at the time of invention that the creator of object, such as a 

17 file, would select the characteristics of that object. For instance, the creator of a music file 

18 would have selected that the content was music content, the extension was MP3, etc. 

19 Furthermore, it was well known in the art that web pages and storage mediums could contain 

20 malicious content and as a result should be checked for malicious content. It therefore would 

21 have been obvious to the ordinary person skilled in the art at the time of invention to employ 

22 what was known in the art in the virus protection of Curtis by allowing the creator of the file to 

23 specify the characteristics of the file. This would have been obvious because the ordinary 

24 person skilled in the art would have been motivated to provide a more flexible environment for 
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1 . the creator. It farther would have been obvious to the ordinary person skilled in the art at the 

2 time of invention to employ what was known in the art in the virus protection of Curtis by 

3 checking for mismatches in web sites and storage mediums as well. This would have been 

4 obvious because the ordinary person skilled in the art would have been motivated to protect 

5 against malicious content in web pages and storage mediums as well as files and attachments. 

6 Regarding claims 46-58, 61-66, 186-198, and 201-206, see the rejections of claims 2-14, 

7 and 17-22 above. 
8 

9 

10 Claims 15-16, 45-66, 81-82, and 185-206 are rejected under 35 U.S.C 103(a) as being 

1 1 unpatentable over Le Pennec. 

12 Regarding claims 15-16, 81-82, 45, 59-60, 185, and 199-200, Le Pennec disclosed 

13 examining at least two characteristics of a digital object; analyzing said at least two 

14 characteristics to determine whether there-exists a mismatch therebetween; and upon 

1 5 determination of the existence of a mismatch, classifying said digital object as a digital object 

16 possibly containing malicious content (See the rejection of claim 1 above), but failed to disclose 

17 that the characteristics may be selected by the creator of the digital object independently of 

18 selection of another characteristic and further failed to disclose that the object could be a web 

1 9 page or storage medium. 

20 It was well known in the art at the time of invention that the creator of a digital signature 

21 could select what was being signed. Furthermore, it was well known in the art that web pages 

22 and storage mediums could contain malicious content and as a. result should be checked for 
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1 malicious content. It therefore would have been obvious to the ordinary person skilled in the art 

2 at the time of invention to employ what was known in the art in the signature system of Le 

3 Pennec by allowing the creator of the file to sign whichever portions of the file the creator 

4 chose. This would have been obvious because the ordinary person skilled in the art would have 

5 been motivated to provide a more flexible environment for the creator. It further would have 

6 been obvious to the ordinary person skilled in the art at the time of invention to employ what 

7 was known in the art in the signature system of Le Pennec by applying the signature checking to 

8 web sites and storage mediums as well. This would have been obvious because the ordinary 

9 person would have been motivated to protect against malicious content in web pages arid 

10 storage mediums as well as files and attachments. 

1 1 Regarding claims 46-58, 61-66, 186-198, and 201-206, seethe rejections of claims 2-14, 

12 and 17-22 above. 
13 

14 Claims 113-125, 172-184, and 231-243 are rejected under 35 ILS.C. 103(a) as being 

15 unpatentable over Curtis as applied to claims 67, 126, and 185 above, and further in view 

16 of Touboul et al. (US Patent Number 6,154,844) hereinafter referred to as Touboul. 

17 Curtis disclosed a system for detecting malicious content comprising: a digital object 

18 examiner (Implementer of Curtis), examining at least two different corresponding characteristics 

19 of a digital object (See Curtis Section 8); a characteristics mismatch detector (Implementer of 

20 Curtis), analyzing said at least two characteristics to determine whether there exists a mismatch 

21 therebetween (See Curtis Section 8); and a digital object classifier (Implementer of Curtis), 

22 operative upon determination of the existence of a mismatch, classifying said digital object as a 
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1 digital object possibly containing malicious content (See Curtis First Paragraph and Section 8), 

2 but failed to disclose the system being implemented in a gateway. 

3 Touboul teaches that in order to protect a network, protection such as determining 

4 suspicion of downloadable content should be applied in a gateway (See Touboul Col. 5 Lines 13- 

5 33). 

6 It would have been obvious to the ordinary person skilled in the art at the time of 

7 invention to employ the teachings of Touboul in the virus protection system of Le Pennec by 

8 . applying the protection in a gateway. This would have been obvious because the ordinary person 

9 skilled in the art would have been motivated to protect the network from transmitting malicious 
10 content. 

11 
12 

13 Claims 113-125, and 231-243 are rejected under 35 U.S.C 103(a) as being 

14 unpatentable over Le Pennec as applied to claims 67 and 185 above, and further in view of 

15 Touboul et al. (US Patent Number 6,154,844) hereinafter referred to as Touboul. 

16 Le Pennec disclosed a system for detecting malicious content comprising: a digital object 

17 examiner, examining at least two different corresponding characteristics of a digital object (See 

18 Le Pennec Paragraph 0192); a characteristics mismatch detector, analyzing said at least two 

19 characteristics to determine whether there exists a mismatch therebetween (See Pennec 

20 Paragraph 0192); and a digital object classifier, operative upon determination of the existence of 

21 a mismatch, classifying said digital object as a digital object possibly containing malicious 
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1 content (See Le Pennec Paragraph 0198), but failed to disclose the system being implemented in 

2 a gateway. 

3 Touboul teaches that in order to protect a network, protection such as determining 

4 suspicion of downloadable content should be applied in a gateway (See Touboul Col. 5 Lines 13- 

5 33). 

6 It would have been obvious to the ordinary person skilled in the art at the time of 



7 invention to employ the teachings of Touboul in the virus protection system of Le Pennec by 

8 applying the protection in a gateway. This would have been obvious because the ordinary person 

9 skilled in the art would have been motivated to protect the network from transmitting malicious 

10 content. 

1 1 Claims 37-38, and 140-141 are rejected under 35 U.S.C. 103(a) as being 

12 unpatentable over Stewart. 

13 Stewart disclosed a method of detecting malicious content comprising: obtaining 

14 information relating to at least two different corresponding characteristics of a digital object (See 

15 Stewart Col. 3 Line 46 - Col. 4 Line 3); analyzing said information to categorize said digital 

16 object into at least two categories (See Stewart Col. 3 Line 46 - Col. 4 Line 3); comparing said at 

17 least two categories to decide whether there exists a mismatch therebetween (See Stewart Col. 3 

18 Line 46 - Col. 4 Line 3); upon determination of the existence of a mismatch, classifying said 

19 digital object as a digital object possibly containing malicious content (See Stewart Col. 3 Line 

20 46 - Col. 4 Line 3), but failed to disclose that the object could be a web page or storage medium. 

21 It was well known in the art that web pages and storage mediums could contain malicious 

22 content and as a result should be checked for malicious content. 
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It would have been obvious to the ordinary person skilled in the art at the time of 



2 invention to employ what was known in the art in the virus detection system of Stewart by 

3 applying virus detection to web pages and storage mediums as well. This would have been 

4 obvious because the ordinary person would have been motivated to protect against malicious 

5 content in web pages and storage mediums as well as files and attachments. 



7 unpatentable over Stewart as applied to claims 23, and 126 above, and further in view of 

8 Pasawicz ("The Importance of File Extensions")* 



10 information relating to at least two different corresponding characteristics of a digital object (See 

1 1 Stewart Col. 3 Line 46 - Col. 4 Line 3); analyzing said information 'to categorize said digital 

12 object into at least two categories (See Stewart Col. 3 Line 46 - Col. 4 Line 3); comparing said at 

13 least two categories to decide whether there exists a mismatch therebetween (See Stewart Col. 3 

14 Line 46 - Col. 4 Line 3); upon determination of the existence of a mismatch, classifying said 

15 digital object as a digital object possibly containing malicious content (See Stewart Col. 3 Line 

16 46 - Col. 4 Line 3), but failed to disclose checking the icon of the object as well in order to 

1 7 determine suspiciousness of the object. 

1 8 Pasawicz teaches that there are many telltale signs of malicious files including icon 

19 "faking" in which the icon does not match the file type in order to mislead a user into thinking 

20 the file is one type (i.e. an image file) when it is actually a different type (i.e. an executable file) 

21 (See Pasawicz Page 5 Col. 1). 



6 



Claims 41-43, and 144-146 are rejected under 35 ILS.C. 103(a) as being 



9 



Stewart disclosed a method of detecting malicious content comprising: obtaining 
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1 It would have been obvious to the ordinary person skilled in the art at the time of 

2 invention to employ the teachings of Pasawicz in the virus detection system of Stewart by 

3 checking the icon type in addition to the extension and content types for coincidence. This 

4 would have been obvious because the ordinary person skilled in the art would have been 

5 motivated to apply the know signs of a malicious file to the detection system in order to trap the 

6 most "viruses" as possible. 

7 Conclusion 

8 Claims 1-88, 113-147, 172-206, and 231-243 have been rejected. 

9 The prior art made of record and not relied upon is considered pertinent to applicant's 

10 disclosure. 

1 1 a. Rosenthal (US Patent Number 5,359,659) disclosed determining suspicious files 

12 based on the filename vs. file extension. 

13 b. Houser et al. (US Patent Number 5,606,609) disclosed determining suspicious 

14 files based on the icon vs. the content. 

15 c. Chen et al. (US Patent Number 5,951,698) disclosed determining suspicious filed 

16 based on the extension and the content. 

17 d. Bates et al. (US Patent Number 6,721,721) disclosed checking web pages for 

18 . viruses. 

19 e. Tsai (US Patent Application Publication 2003/0097409) disclosed parsing an E- 

20 mail header and attachments for suspicious content. 
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1 Applicant's amendment necessitated the new ground(s) of rejection presented in this 

2 Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 

3 Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

4 A shortened statutory period for reply to this final action is set to expire THREE 

5 MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 

6 MONTHS of the mailing date of this final action and the advisory action is not mailed until after 

7 the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 

8 will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 

9 CFR 1 . 1 36(a) will be calculated from the mailing date of the advisory action. In no event, 

10 however, will the statutory period for reply expire later than SIX MONTHS from the date of this 

1 1 final action. 

1 2 Any inquiry concerning this communication or earlier communications from the 

13 examiner should be directed to Matthew T. Henning whose telephone number is (571) 272-3790. 

14 The examiner can normally be reached on M-F 8-4. 

15 If attempts to reach the examiner by telephone are unsuccessful, the examiner's 

16 supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 

17 organization where this application or proceeding is assigned is 571-273-8300. 
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